Discovery and Integration Content Guide - General Reference · UniversalCMDB SoftwareVersion:ContentPack20.00(CP20) DiscoveryandIntegrationsContentGuide-General Reference DocumentReleaseDate:June2016

Universal CMDBSoftware Version: Content Pack 20.00 (CP20)

Discovery and Integrations Content Guide - GeneralReference

Document Release Date: June 2016Software Release Date: June 2016

Legal Notices

WarrantyThe only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothingherein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.

The information contained herein is subject to change without notice.

Restricted Rights LegendConfidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying. Consistent with FAR 12.211 and 12.212, CommercialComputer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commerciallicense.

Copyright Notice© 2002 - 2016 Hewlett Packard Enterprise Development LP

Trademark NoticesAdobe™ is a trademark of Adobe Systems Incorporated.

Microsoft® andWindows® are U.S. registered trademarks of Microsoft Corporation.

UNIX® is a registered trademark of TheOpenGroup.

Documentation UpdatesThe title page of this document contains the following identifying information:

l Software Version number, which indicates the software version.l Document Release Date, which changes each time the document is updated.l Software Release Date, which indicates the release date of this version of the software.

To check for recent updates or to verify that you are using themost recent edition of a document, go to: https://softwaresupport.hp.com/.

This site requires that you register for an HP Passport and to sign in. To register for an HP Passport ID, click Register on the HP Software Support site or click Create anAccount on the HP Passport login page.

You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your HPE sales representative for details.

SupportVisit the HP Software Support site at: https://softwaresupport.hp.com.

This website provides contact information and details about the products, services, and support that HP Software offers.

HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed tomanage yourbusiness. As a valued support customer, you can benefit by using the support website to:

l Search for knowledge documents of interestl Submit and track support cases and enhancement requestsl Download software patchesl Manage support contractsl Look up HP support contactsl Review information about available servicesl Enter into discussions with other software customersl Research and register for software training

Most of the support areas require that you register as an HP Passport user and to sign in. Many also require a support contract. To register for an HP Passport ID, clickRegister on the HP Support site or click Create an Account on the HP Passport login page.

To findmore information about access levels, go to: https://softwaresupport.hp.com/web/softwaresupport/access-levels.

HPSW Solutions Catalog accesses the new HPSW Integrations and Solutions Catalog website. This site enables you to explore HP Product Solutions tomeet your businessneeds, includes a full list of Integrations between HP Products, as well as a listing of ITIL Processes. The URL for this website ishttps://softwaresupport.hp.com/km/KM01702710.

Discovery and Integrations Content Guide - General Reference

HPE Universal CMDB (Content Pack 20.00 (CP20)) Page 2 of 40

https://softwaresupport.hp.com/

https://softwaresupport.hp.com/

https://softwaresupport.hp.com/web/softwaresupport/access-levels

https://softwaresupport.hp.com/km/KM01702710

Contents

Chapter 1: How to Define a NewPort 5Chapter 2: How to Discover IP Addresses in Universal Discovery 7Chapter 3: How to Use the cpVersion Attribute to Verify ContentUpdate 9Chapter 4: How to Delete Files Copied to RemoteMachine 10Chapter 5: How to RunHPCmd fromWindows Server 2008, 2008R2, 2012, and 2012 R2Machines 11Chapter 6: Files Copied to a RemoteMachine 13Chapter 7: Content Pack Configuration Files 16

globalSettings.xml File 16portNumberToPortName.xml File 32

Chapter 8: Additional Protocol Information 33Extended Shell Interface 33How to Create an SSH Connection Based on Public/Private Keys Pair 33How to Enable Support for the AES256-CBC and AES256-CTREncryption Ciphers 35

Chapter 9: PrimaryDNSName Logic 36Chapter 10: Supported UNIX Shells 37Chapter 11: Troubleshooting and Limitations 38Send Documentation Feedback 40


Page 4 of 40HPE Universal CMDB (Content Pack 20.00 (CP20))

Discovery and Integrations Content Guide - General Reference

Chapter 1: How to Define a New PortEdit the portNumberToPortName.xml file to define a new port:

1. In the Adapter Management window (Managers > Data Flow Management > AdapterManagement), search for the portNumberToPortName.xml file: click the Find resource buttonand enter portNumberToPortName.xml in theName box. Click Find Next, then click Close.

The file is selected in the Resources pane and the file contents are displayed in the View pane.

For details about this file, see "portNumberToPortName.xml File" on page 32.

2. Add another row to the file andmake changes to the parameters:

<portInfo portProtocol="xxx" portNumber="xxx" portName="xxx" discover="0"cpVersion="xx"/>

Parameter Description

portProtocol The network protocol used for discovery (udp or tcp).

portNumber The port number to be discovered.

This attributemay be a number or a range. Ranges may be separated bycommas or dashes or both. For example: "10, 21, 45", "10-21", or "10-21, 45,110".

portName The name that is to be displayed for this port.

discover 1. This port must be discovered.

0: This port should not be discovered.

cpVersion Use this parameter when you want to export the portNumberToPortName.xmlfile to another UCMDB system with the PackageManager. If theportNumberToPortName.xml file on the other system includes ports for thisapplication but does not include the new port you want to add, the cpVersionattribute ensures that the new port information is copied to the file on the othersystem.

The cpVersion valuemust be greater than the value that appears in the root ofthe portNumberToPortName.xml file.

For example, if the root cpVersion value is 3:

<portList parserClassName="com.hp.ucmdb.discovery.library.communication.downloader.cfgfiles. KnownPortsConfigFile"cpVersion="3">

the new port entry must include a cpVersion value of 4:



<portInfo portProtocol="udp" portNumber="1" portName="A1"discover="0" cpVersion="4"/>

Note: If the root cpVersion value is missing, you can add any non-negativenumber to the new port entry.

This parameter is also needed during Content Pack upgrade. For details, see"How to Use the cpVersion Attribute to Verify Content Update" on page 9.

Discovery and Integrations Content Guide - General ReferenceChapter 1: How to Define a New Port


Chapter 2: How to Discover IP Addresses in UniversalDiscoveryIn Universal Discovery, IP addresses can be defined as the following two types:

l Data center IP addresses. These IP addresses are stable or long-term.

l Client IP addresses. These IP addresses are dynamic or short-term.

This task contains the following:

l How to discover Data center IP addressesa. Run the following ICMP jobs:

l Range IPs by ICMP

l Class B IPs by ICMP

l Class C IPs by ICMP

b. Run theRange IPs by nmap job.

For details about these jobs, see theHPE UCMDB Discovery and Integrations Content Guide -Discovery Modules.

l How to discover Client IP addressesa. Run theClient Connection by SNMP job to discover switches or routers. The IP addresses

need to be defined in the Data Flow Probe range as the Client IP addresses.

b. Run the IP MAC Harvesting by SNMP job to discover Client IP addresses that are cached inthe triggered switch or router.

For details about these jobs, see theHPE UCMDB Discovery and Integrations Content Guide -Discovery Modules.

l How to improve performance for IP addresses related jobso Adjust the following job parameters if available:

l bulkSize

l retryDiscover

l threadPoolSize

l timeoutDiscover


For details about these job parameters, see theHPE UCMDB Discovery and IntegrationsContent Guide - Discovery Modules.

o Change theGet Request Operation Type value in the SNMP protocol fromGet-NEXT toGet-BULK if possible.

For details about this value, see theSNMP Protocol section of theHPE UCMDB Discovery andIntegrations Content Guide - Supported Content.

Discovery and Integrations Content Guide - General ReferenceChapter 2: How to Discover IP Addresses in Universal Discovery


Chapter 3: How to Use the cpVersion Attribute toVerify Content UpdateThe cpVersion attribute is included in the portNumberToPortName.xml file, and indicates in whichContent Pack release a port has been discovered. For example, the following code defines that theLDAP port 389 has been discovered in Content Pack 11.00:

<portInfo portProtocol="tcp" portNumber="389" portName="ldap" discover="11"cpVersion="11"/>

During a Content Pack upgrade, DFM uses this attribute to perform a smart merge between theexisting portNumberToPortName.xml file (whichmay include user-defined ports) and the new file.Entries previously added by the user are not removed and entries previously deleted by the user are notadded.

For details about the portNumberToPortName.xml file, see "portNumberToPortName.xml File" onpage 32.

To verify that a Content Pack is successfully deployed:

1. Install the latest Service Pack release.

2. Start the UCMDB Server.

3. Verify that all services are running. For details, see the section about HPE Universal CMDBServices in theHPE Universal CMDB Administration Guide.

4. Install and deploy the latest Content Pack release. For details, refer to the Content Packinstallation guide.

5. In the Adapter Management window, access the portNumberToPortName.xml file.

6. Verify that no user-defined ports have been deleted and that any ports deleted by the user have notbeen added.


Chapter 4: How to Delete Files Copied to RemoteMachineDuring discovery, the Data Flow Probe copies files to a remoteWindows machine. For details, see"Files Copied to a RemoteMachine" on page 13.

To configure DFM to delete files copied to the destination machine after discovery is finished:

1. Access the globalSettings.xml file: Adapter Management > AutoDiscoveryContent >Configuration Files.

2. Locate the removeCopiedFiles parameter.

o true. The files are deleted.

o false. The files are not deleted.

3. Save the file.

To control HPCmd behavior:

1. In the globalSettings.xml file, locate theNtcmdAgentRetention parameter.

2. Enter one of the following:

o 0. (The default) Unregister the service and delete the remote executable file. (Unregister: stopthe service and remove it from the remotemachine, so that it is no longer listed in the list ofservices.)

o 1. Unregister the service, but leave the executable file on the file system.

o 2. Leave the service running, and leave the executable file on the file system.


Chapter 5: How to Run HPCmd from Windows Server2008, 2008 R2, 2012, and 2012 R2 MachinesPerform the following to ensure that HPCmd functions properly when the Probe is installed on aWindows Server 2008, 2008 R2, 2012, or 2012 R2machine:

1. Stop the Probe.

2. Open the standardWindows Registry Editor application by running the regedit executable.

3. In the Registry Editor navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

4. Under this key there should be aREG_DWORD parameterSCMApiConnectionParam

a. If this is missing, add a new REG_DWORD parameterSCMApiConnectionParam and setits value to 0x80000000.

b. If this value is already available in the registry, combine it with the 0x80000000mask (usingbitwise OR). For example, if there was a value 0x1 in there, you need to set this value to0x80000001.

Note: To run HPCmd from aWindows 2008machinewith UAC enabled, also performthe following additional steps. Do not perform these steps for a Windows Server2008 R2, 2012, or 2012 R2 machine.

5. Locate thewrapper.exe file, in the hp\UCMDB\DataFlowProbe\bin directory.

6. Right-click thewrapper.exe file, and select Properties.

7. In theCompatibility tab:

a. Select Compatibility mode.

b. Select Run this program in compatibility for:Windows XP (Service Pack 2).

c. Select Run this program as administrator.

8. Start the Probe.

Note: HPCmd uses DCOM protocol for connecting to remotemachines. The DCOM protocolrequires that the following ports are open: 135, 137, 138, and 139. In addition it uses arbitrary portsbetween 1024 and 65535, but there are ways to restrict the port range used by WMI/DCOM/RPC.For information about configuring DCOM to work with firewalls, see


http://support.microsoft.com/kb/154596/en-us.

Discovery and Integrations Content Guide - General ReferenceChapter 5: How to Run HPCmd fromWindows Server 2008, 2008 R2, 2012, and 2012 R2Machines


http://support.microsoft.com/kb/154596/en-us

Chapter 6: Files Copied to a Remote MachineDuring discovery, Data Flow Probe copies files to a remoteWindows machine to enable discovery ofthemachine's components. The files are copied to the%SystemRoot%\system32\drivers\etc\ folderon the remotemachine.

Note:

l Data Flow Management runs HPCmdSvc.exe to connect to and retrieve the Shell on theremotemachine.

l When thewmic command is launched on the remoteWindows machine, by theHostConnection by Shell orHost Resources by Shell orHost Applications by Shell jobs, anempty TempWmicBatchFile.bat file is created.

The following files are copied:

File

ContentPackVersion Description

adsutil.vbs All The Visual Basic script used for discovery of Microsoft IISapplications. DFM copies this script to the remotemachine todiscover IIS.

Relevant DFM Job: IIS Applications by NTCMD or UDA

diskinfo.exe All The executable that enables the retrieval of disk informationwhen it is not available to be retrieved by wmic.

DFM discovers default disk information with thewmic query.However, if thewmic query fails to execute, DFM copies thediskinfo.exe file to the remotemachine. This failure canoccur if, for examplewmic.exe is not included in the PATHsystem variable or is completely absent on the remotemachine, as is the case onWindows 2000.

Relevant DFM Job:Host Resources by Shell


File


Exchange_Server_2007_Discovery.ps1

CP4 The PowerShell script for MS Exchange 2007 discovery.

DFM uses a PowerShell scenario to discover MicrosoftExchange 2007 by NTCMD. This file, therefore, must becopied to the remotemachine.

Relevant DFM Jobs:

l Microsoft Exchange Connection by NTCMD or UDA

l Microsoft Exchange Topology by NTCMD or UDA

GetFileModificationDate.vbs

CP5 The Visual Basic script for retrieving the file modification date(disregarding locale).

Themost common use case is when DFMmust retrieve thelast modification date of a configuration file of a discoveredapplication.

Relevant DFM Jobs:

l Apache Tomcat by Shell

l File Monitor by Shell

l IIS Applications by NTCMD or UDA

l JEEWeblogic by Shell

l JEEWebSphere by Shell or JMX

l JEEWebSphere by Shell

l SAP System by Shell

l Service Guard Cluster Topology by TTY

l Siebel Application Server Configuration

l Software Element CF by Shell

l Veritas Cluster by Shell

l WebServer by Shell

getfilever.vbs All The Visual Basic script used to identify the version of therunning software. The script retrieves the executable or DLLfile version onWindows machines.

This script is used by Shell-based application signatures plug-ins to retrieve the version of a particular software on theremotemachine.

Relevant DFM Job: Host Applications by Shell

Discovery and Integrations Content Guide - General ReferenceChapter 6: Files Copied to a RemoteMachine


File


junction.exe CP5 This executable file, part of the Sysinternals Suite(http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx), enables the creation of ajunction point. DFM uses this file if the linkd.exe andmklink.exe tools are absent on the remotemachine.

When DFM runs discovery on aWindows x64machine, DFMneeds to bypass theWindows redirect feature running on thatmachine. DFM does this by creating a link to the%SystemRoot%\System32 folder with either the linkd.exeormklink.exe tool. However, if these tools aremissing on theremotemachine, DFM transfers junction.exe to the remotemachine. DFM is then able to launch the 64-bit version of thesystem executable files. (Without this 64-bit version, DFMwould be locked into an isolated 32-bit world.)

This junction point is automatically removed once discoveryis complete.

Relevant DFM Jobs:

l Host Resources by Shell

l Host Applications by Shell

l Microsoft Exchange Connection by NTCMD or UDA

l Microsoft Exchange Topology by NTCMD or UDA

meminfo.exe All The executable that enables the retrieval of memoryinformation.

DFM discovers memory information with thewmic query.However, if thewmic query fails to execute, DFM copies thememinfo.exe file to the remotemachine. This failure canoccur if, for example, wmic.exe is not included in the PATHsystem variable or is completely absent on the remotemachine, as is the case onWindows 2000.

Relevant DFM Job:Host Applications by Shell

reg_mam.exe All The copy of theMicrosoft reg.exe file that enables queryingthe registry.

If DFM does not discover a native reg.exe file, thisexecutable is copied to the remoteWindows machine. Thissituation occurs with some previous Windows versions (forexample, Windows 2000) where the tool is not included bydefault but can still function there correctly.

Relevant DFM Job: Host Applications by Shell

Discovery and Integrations Content Guide - General ReferenceChapter 6: Files Copied to a RemoteMachine


http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

Chapter 7: Content Pack Configuration FilesThe Content Pack contains configuration files which enable you to configure commonly usedparameters such as command timeouts, usage of some utilities, application signatures, and so on.

This section includes:

l "globalSettings.xml File" below

l "portNumberToPortName.xml File" on page 32

globalSettings.xml FileThe following table describes the parameters in the globalSettings.xml configuration file (Data FlowManagement > Adapter Management > Resources > Packages > AutoDiscoveryContent >Configuration Files):


AdditionalClasspath Additional path that enables to run different patterns (that is,database patterns); all paths should be relative to the$PROBE_INSTALL/root/lib/collectors/probeManager/discoveryResources/ folder and should besemicolon separated

Example:

<property name="AdditionalClasspath">db/oracle/.;db/mssqlserver/.</property>means that following paths will be included in the classpath:

l $PROBE_INSTALL/root/lib/collectors/probeManager/discoveryResources/db/oracle/

l $PROBE_INSTALL/root/lib/collectors/probeManager/discoveryResources/db/mssqlserver/

allowCaliperOnHPUX Indicates whether to allow the execution of caliper on HP-UX.This setting will be used in theWebSphere_By_Shelladapter, to get the full command line when the ps commandfails to do so.

Default: false



allowCallhome Indicates whether to allow to call home.

Default: true

allowCallhomeInterval The time interval in hours that is allowed between two callhome requests from the same host.

Default: 24

allowDataCenterCallhome Indicates whether to allow Data Center IP addresses to callhome.

Default: true

allowGettingCredentialSecuredAttribute

Indicates whether Jython scripts are allowed to getcredentials secured data (true) or not (false). If this setting isset to false, then Jython scripts are not allowed to retrievesensitive credentials data (like passwords that are stored onthe server side).

Default: true

allowPFilesOnSunOS Indicates whether to allow the execution of pfiles on Solaris.

Default: false

Caution:Setting this parameter to truemay causeproblems for some processes on some Solaris systems.

allowPFilesOnHPUX Indicates whether to allow the execution of pfiles on HP-UX.

Default: false

Caution:Setting this parameter to truemay causeproblems for some processes on someHP-UX systems.

autoTruncateDbEncoding Indicates the encoding used by the CMDB underlyingdatabase. This property is used for calculating the number ofcharacters that should be sent after truncation.

Default:UTF8

autoTruncatePercentage If the value of the attribute (with the DDM_AUTOTRUNCATE qualifier) exceeds the size limit multipliedby this parameter it will be truncated to the specified part ofthe defined size.

Default: 100 percent

Discovery and Integrations Content Guide - General ReferenceChapter 7: Content Pack Configuration Files



clearCommandLineForProcesses

Clears the Command line for these processes.

This option is used to ensure that no private or confidentialdata is stored in CMDB.

Default: srvrmgr.exe, srvrmgr, xCmd.exe, HPcmd.exe,ssonsvr.exe

Syntax exceptions: Process names are case insensitiveand should be split by commas.

consoleCommands The comma-separated list of commands globally available forall PowerShell connections.

The commands specified in this list will be executed usingCMD interpreter (cmd /c "command")

datacenter callhome If themanagement zone is set to Data Center and thisparameter is enabled, Data Flow Probe ignores call homemessages from Universal Discovery Agent.

Default:Enabled

dbQueryTimeout The timeout (in seconds) for all SQL queries. Indicates howlong to wait for query results.

The timeout applies only if the value is greater than zero (0).

Default: 100 seconds

Note: Some JDBC drivers cannot support this setting.

ddmagentCiphers The algorithm used by the UD Agent to encrypt or decrypt thedata transferred to or from client machines.

ddmagentPrefix The prefix used by the UD Agent.

ddmagentProtocol The protocol used by the Probe to communicate with UDAgent.

ddmagentEnableDownloadResume

Specifies whether the resumable download is enabled or not.

true. The resumable download functionality is available.

false. The resumable download functionality is not available.

ddmagentDefaultBlockLen The default chunk size (in bytes) used to upload/downloadfiles to/from the UD Agent.

ddmagentResumableFileSuffix The file extension used for parts of the resumable transfer file.

ddmagentDefaultResumeBlockLen

The default chunk size (in bytes) for resumable file transfer.




ddmagentEnableUploadResume Specifies whether the resumable upload is enabled or not.

true. The resumable upload functionality is available.

false. The resumable upload functionality is not available.

defaultSapClients When this parameter is defined, you do not need to specifythe SAP Client Number parameter in the SAP ABAP protocol.Instead, you can create one or more comma-separatedcredentials for multiple SAP systems with different supportedclients.

Example:<property name="defaultSapClients">800,500,200,300</property>

Default: 800

desktopOperatingSystems

serverOperatingSystems

These two parameters are used to determine if the host'soperating system is of type Desktop or Server. If the host'soperating system name contains a value from one of theselists, its host_isdesktop is set accordingly. Otherwise thevalue of host_isdesktop attribute is left empty.

discovereAllListenPorts Related to application signatures configuration.




discoveredStorageTypes Describes storage types which have to be reported toUCMDB. Options are split by commas.

Available options are:

l FixedDisk

l NetworkDisk

l CompactDisk

l RemovableDisk

l FloppyDisk

l VirtualMemory

l FlashMemory

l RamDisk

l Ram

l NoRoot Directory

l Other

l UNKNOWN

enableJeeEnhancedTopology Indicates whether to enable the reporting of the improved JEEtopology.

Default: false

enableNormalizationRuleLabel Specifies whether the label format for output values in thenormalization rule is enabled or not.

If you want to display values in the label format instead of thedefault format that contains underscores for the normalizedfields, do the following:

1. Add <propertyname="enableNormalizationRuleLabel">true</property> in the globalSettings.xml file if it does not exist.

2. Restart the probe.

Default: false




enableSSHSharedHomeDir Setting this parameter to true enables Inventory Discoveryvia SSH to be able to use a user account that has the sharedhome directory. For example, the home directory is mountedvia NFS or Samba, so that the same directory is used whenthe user logs into different computers.

In order for this feature to work correctly, Universal DiscoveryAgent cannot be installed to run under a user account that hasthe home directory that is shared (for example, mounted viaNFS or Samba). If it is already installed, uninstall it. For moreinformation, see theHow to Completely Uninstall theUniversal Discovery Agent section in theData FlowManagement Guide.

To enable this feature, set this parameter value to true. Thedefault value is false.

Caution:Enabling and then disabling this featuremaycause unpredictable behavior.

Note:

l Do not install Universal Discovery Agent to run undera user account that has the shared home directory(for example, mounted via NFS or Samba) after youenable this feature.

l In UCMDB, youmay unexpectedly see newly-created empty Node CIs. You can delete them, orwait for the agingmechanism to delete them (usuallyafter 40 days).

l The software utilization information cannot bereported by the Inventory Discovery by Scanner jobwhen using the SSH protocol.

IgnoreClassAttributes Ignores the attributes in the discovery result processing.

Format: node.name, node.description

Data Flow Probe will not validate the node attribute name anddescription. The probe will not report these attributes toUCMDB.

Default: node.misc_info




ignoreLocalizedVirtualInterfacesPatternList

Lists patterns for localizedWindows Virtual interfacedescription that must not take part in the Host Key creationprocess.

Format: Comma-separated list of strings, no additionalwhite-spaces allowed.

ignoreVmwareInterfaces Indicates whether to ignore the VMwareMAC address.

l When there is a Physical MAC (default). The VMwareMAC address is used only if the pattern cannot find anyphysical MAC address.

l Always. Always ignore VMwareMAC address.




jdbcDrivers This section enumerates driver classes used to connect to adedicated Database server. Names of sub-keys must be thesame as used in credentials (sqlprotocol_dbtype attribute ofprotocol).

Change them if drivers other thanOOTB JDBC drivers areused.

Default values for OOTB-installation:

<property name="jdbcDrivers:><oracle>oracle.jdbc.OracleDriver</oracle><oracleSSL>oracle.jdbc.OracleDriver</oracleSSL><MicrosoftSQLServer>net.sourceforge.jtds.jdbc.Driver</MicrosoftSQLServer><MicrosoftSQLServer> net.sourceforge.jtds.jdbc.Driver</MicrosoftSQLServerNTLM><MicrosoftSQLServerNTLMv2>net.sourceforge.jtds.jdbc.Driver</MicrosoftSQLServerNTLMv2><Sybase>com.sybase.jdbc.SybDriver</Sybase><db2>com.ibm.db2.jcc.DB2Driver</db2><mysql>com.mysql.jdbc.Driver</mysql></property>




jdbcPreUrls This section enumerates URL templates used to connect todedicated the database server. Names of sub-keys must bethe same as those used in credentials (sqlprotocol_dbtypeattribute of protocol). Change them if drivers other thanOOTBJDBC drivers are used. Values depend on used drivers andshould be taken from driver documentation.

Note: The ampersand symbol (&) must be escapedaccording to the XML standard (&).

Default values for OOTB-installation:<property name="jdbcPreUrls"><oracle>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=%%ipaddress%%)(PORT=%%protocol_port%%))(CONNECT_DATA=(%%connect_data%%=%%sqlprotocol_dbsid%%)))</oracle><oracleSSL>jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=%%ipaddress%%)(PORT=%%protocol_port%%))(CONNECT_DATA=(%%connect_data%%=%%sqlprotocol_dbsid%%)))</oracleSSL><MicrosoftSQLServer>jdbc:jtds:sqlserver://%%ipaddress%%:%%protocol_port%%;instanceName=%%sqlprotocol_dbname%%;loginTimeout=%%protocol_timeout%%;logging=false;ssl=request</MicrosoftSQLServer><MicrosoftSQLServerNTLM>jdbc:jtds:sqlserver://%%ipaddress%%:%%protocol_port%%;instanceName=%%sqlprotocol_dbname%%;domain=%%sqlprotocol_windomain%%;loginTimeout=%%protocol_timeout%%;logging=false</MicrosoftSQLServerNTLM>




jdbcPreUrlscontinued

<MicrosoftSQLServerNTLMv2>jdbc:jtds:sqlserver://%%ipaddress%%:%%protocol_port%%;instanceName=%%sqlprotocol_dbname%%;domain=%%sqlprotocol_windomain%%;loginTimeout=%%protocol_timeout%%;logging=false;ssl=request;useNTLMv2=true</MicrosoftSQLServerNTLMv2><Sybase>jdbc:sybase:Tds:%%ipaddress%%:%%protocol_port%%?DatabaseName=%%sqlprotocol_dbname%%</Sybase><db2>jdbc:db2://%%ipaddress%%:%%protocol_port%%/%%sqlprotocol_dbname%%</db2><mysql>jdbc:mysql://%%ipaddress%%:%%protocol_port%%/%%sqlprotocol_dbname%%</mysql><parameters><parameter type="oracle" name="connect_data"><value>SERVICE_NAME</value><value>SID</value></parameter><fallbackExceptionList><error type="oracle">.*ORA\-12514.*</error></fallbackExceptionList></parameters></property>

Each <parameter> element has a name attribute and one ormore <value> tags. Each <parameter> can be used in theOracle URL template by using the format “%%[parametername]%%” (for example, %%connect_data%%).

If a <parameter> has more than one <value> tag, then theparsing engine generates all permutations of the possiblevalues in the template string, and the client tries to connect tothe database server by each of these permutations.

Since during connection errors can occur, the<fallbackExceptionList> element specifies which errorsshould be ignored if they occur. If the engine ignores such anerror, then it tries to connect using another permutation ofvalues in the template string. If an error occurs that is notspecified by <fallbackExceptionList>, the engine does nottry another permutation and the job fails with the errormessage that was caught.




loadExternalDTD Used to configure file_mon_utils to prevent downloading DTDfiles while validating the XML.

Default: false

maxExecutionRecords Specifies maximal number of execution records that can be inthe communication log. This parameter should be used whenthe discovery process discovers a lot of data. The parametercan be overridden on an adapter level. In this case, add theparameter to the adapter with desired record limit (see Probedocumentation).

Default: -1 means unlimited

maximumConnectionsPerSecond

Enables limiting the number of new connections per secondcreated by the Probe to other machines.

l 0. Unlimited number of connections allowed.

l > 0. Themaximum number of connections. If this limit isreached, any job trying to create a new connection willwait for a period of time that is determined in the"timeToSleepWhenMaximumConnectionsLimitReached"parameter below.

Default: 0 (unlimited)

maxStoreSentResults Specifies maximal number of sent results that can be storedin the communication log.

This parameter can be changed if there are toomany resultsstored in the communication log.

If this value is greater than 0, the log will store thecorresponding number of results for deleted results ANDupdated results, meaning that the results set will containdouble the value ofmaxStoreSentResults.

Default: -1 means unlimited

maxPingIPv6CountPerRange Specifies themaximum IPv6 count of per range for PingSweep.

Default: 1000000

multipleDB2Instances Indicates whether multiple DB2 instances are installed on thesame server.

Default: true

multipleUpdateIgnoreTypes Used by UCMDB. The Probe does not generate aMultipleupdates in bulkwarning for enumerated CI types.




notRecordedMethods Specifies a list of methods that are not to be recorded in thecommunication log.

To remove amethod from being recorded in thecommunication log, copy its name from the communicationlog and add it here.

Example:

<property name="notRecordedMethods">

<method>getLastCommandOutputBytes</method>

</property>

NtcmdAgentRetention NTCMD agent retentionmode. Specifies how to handle aremote NTCMD service and its executable file when closingthe connection.

l 0 (default). Unregister the service and delete the remoteexecutable file.

l 1. Unregister the service but keep the executable file onthe file system.

l 2. Leave the service running, keep the executable file.

NtcmdSessionUseProcessBuilder

This parameter is forNtcmdSessionAgent and should bealways be true. This parameter tells how to create a newprocess.

l true. The new process will be created by ProcessBuilder(new API from Java 5.0)

l false. The new process will be created by Runtime.exec(old API, from Java 1.4.2). Set to false only in case ofbackward compatibility problems.

objectSendAmountThreshold When the number of discovered objects exceeds thisthreshold, the objects are immediately sent to the server.Requires using the sendObject(s) API in jython scripts.

Default: 2000 objects

objectSendTimeThreshold Whenmore than the specified time (in seconds) has passedsince the previous object report, the objects are immediatelysent to the server. Requires using the 0sendObject(s) API injython scripts.

Default: 300 seconds




pingClientTypeIp (Only for the Inventory Discovery by Scanner job) Indicateswhether to allow to ping Client IP addresses.

Default: false

pingHostName (Only for the Inventory Discovery by Scanner job) Indicateswhether to allow to ping host names.

Default: false

portExpirationTime The expiration time (in seconds) of the TCP/UDP port entry inthe Probe's database.

Default: 60 seconds

powershellConnectionIdleTimeout

Defines themaximum idle time (in milliseconds) for thepowershellconnector.exe process.

The timer resets its state after each command execution.

Default: 3600000milliseconds (1h)

processExpirationTime The expiration time (in seconds) of the Process entry in theProbe database.

Default: 60 seconds

protocolConnectionOrder The protocol connection order for theHost Connection byShell job.

Default: ssh, telnet, ntadmin

remoteProcessTimeout After being launched, the remote process should connect withthe Probe within the defined time (in milliseconds), otherwisethe following error is produced: Failed to connect to remoteprocess.

Default: 300000milliseconds (5minutes)

removeCopiedFiles In some cases DFM copies scripts and third-party utilities ona client machine. The removeCopiedFiles parameterdefines whether these files should (true) or should not (false)be deleted after discovery is finished.

reportSapAppServerDatabase Indicates whether to report SAP Application Serverdatabases that are based on the configuration file content.

Only affects theHost Applications by Shell, andSAPABAP Topology by SAP JCO jobs.

Default: false




reportPhysicalSerialNumbers Indicates whether to report physical serial numbers fromhwsmbiosPhysicalAttributeSerialNumber of scan files.

Default: false

ResultProcessIsLenient When setting to true, the discovery result processing islenient, which is not recommended:

l If a reported string attribute has a too large value, thestring is automatically truncated according to the CMDBClass Model definition.

l If the OSH attribute is invalid (type/nonexistingattribute/missing ID attribute), only the invalid OSH isdropped, rather than entire bulk (default).

Default: false

setBiosUuidToMicrosoftStandart Indicates whether the BIOS UUID value forWindowsoperating systems should be reported in Microsoft style(some bytes order reversed) instead of the original BIOSvalue. Affects Host Connection jobs.

l false (default). Converts to original BIOS stored value

l true. Converts to Microsoft standard.

Note: Setting this parameter to truemay result inconflicts with the BIOS UUID value discovered byVMware jobs or some integrations.

shellGlobalBandwidthLimit Themaximum bandwidth (in kilobits per second) to uploadand download files to and from the discovery node

Note: If no value or 0 is assigned, all of the availablebandwidth is used.

shellGlobalCommandTimeout Global timeout (in milliseconds) for all Shell client commands.Indicates how long to wait for a command's result.

Default: 15000milliseconds

siebelCommandTimeout The amount of time to wait for the Siebel command's result.

Default: 3minutes (180000ms)




snmpGlobalRequestTimeout This is the time, in milliseconds, after which a request usingSNMP will timeout.

Default: 3,000milliseconds

Note: This value is global for all SNMP requests. If youwant to override the SNMP request timeout for a specificquery (where you know the query takes more time thanthe default timeout), provide the timeout value as asecond parameter to the executeQuery method on theSNMP client: snmpClient.executeQuery(SNMP_QUERY_STRING, QUERY_TIMEOUT_IN_MILLISECONDS).

snmpTestQueries Defines the default SNMP test query for SNMP Agent. Canbe overridden for specific devices.

Default:

<property name="snmpTestQueries">

<query>1.3.6.1.2.1.1.1,1.3.6.1.2.1.1.2,string</query>

</property>

ssh-log-level The SSH log level.

Levels: 1-7, where 7 is themost detailed defect level.

tcpExpirationTime The expiration time (in hours) of TCP connection entry inprobe database.

Default: 24 hours

timeToSleepWhenMaximumConnectionsLimitReached

Determines how long (in milliseconds) a job needs to waituntil a new connection can be created, assuming themaximum connections limit has been reached. (See"maximumConnectionsPerSecond" above.)

Default: 1000milliseconds (1 second)

Note: IfmaximumConnectionsPerSecond = 0 thisproperty is ignored.




tnsnamesFilePaths Paths to search the tnsnames.ora file (includingtnsnames.ora itself, comma separated)

Example:

<property name="tnsnamesFilePaths">c:\temp\tnsnames.ora</property>

useIntermediateFileForWmic Usage of an intermediate temporary file for data transfer bywmic command.

Default: false

useJinteropOnWindows This property is used onWindows machines.

l true. The Probe uses JInterop forWMI discovery.

l false (default). The Probe uses WMIdll native code.

useNtcmdModifiedMarkers l true. The Probe uses markers with counters in NTCMDagents' infrastructure.

l false (default). The Probe uses old NTCMD behavior -without markers with counters.

useWinexeOnLinux This setting is used on non-Windows machines.

l true. The Probe uses local winexe executable for NTCMDWindows discovery.

l false (default). The Probe uses Windows remote Proxy.



portNumberToPortName.xml FileThe portNumberToPortName.xml file is used by DFM as a dictionary to create IpServiceEndpointCIs by mapping port numbers tomeaningful port names. When a port is discovered, the Probe extractsthe port number, searches in the portNumberToPortName.xml file for the port name that correspondsto this port number, and creates the IpServiceEndpoint CI with that name. If the port name does notappear in this file, the Probe uses the port number as the port name.

You can specify different names for same port number for different IP ranges. In this case, the sameport discovered for IPs contained in different ranges will have different port names.

Note: The portNumber attributemay be a number or a range. Ranges may be separated bycommas or dashes or both. For example: "10, 21, 45", "10-21", or "10-21, 45, 110". Youmay use xas a wildcard in any position in a number. For example “5xx00” includes ports 50000, 50100,50200, …51000, 51100, 51200, …59900.

For details on adding new ports to be discovered, see "How to Define a New Port" on page 5.



Chapter 8: Additional Protocol InformationThis section includes:

l "Extended Shell Interface" below

l "How to Create an SSH Connection Based on Public/Private Keys Pair" below

l "How to Enable Support for the AES256-CBC and AES256-CTR Encryption Ciphers" on page 35

Extended Shell InterfaceUCMDB 10.00 extended the Shell Interface to remove limitations when uploading files to, anddownloading files from, Windows machines. This increased functionality applies to the NTCMD andSSH protocols, and UD Agents.

When uploading or downloading files to or fromWindows machines, you can set the parametersetBandwidthLimit, to restrict network bandwidth consumption.

You can set this parameter in globalSettings.xml:

The property is shellGlobalBandwidthLimit. For shell objects that support file downloading anduploading, it sets a limit, in kilobits per second, on the amount of bandwidth consumed by the downloador upload operation. The valuemust be a positive integer. The default is 0, meaning no limit. Forexample:

<property name="shellGlobalBandwidthLimit">0</property>

The speed can be overwritten at adapter level or at job level; for example, when installing or updatingUD Agents.

How to Create an SSH Connection Based on Public/PrivateKeys PairTo create a Secure Shell (SSH) connection based on a public/private keys pair, perform the followingsteps:

1. Open theMindterm console (on the probemachine) and from the command line run followingcommand:


C:\hp\UCMDB\DataFlowProbe\bin\jre\bin\java.exe -jarC:\hp\UCMDB\DataFlowProbe\content\lib\Mindterm.jar

2. In theMindterm console, go to File > Create Keypair and assign the following values:

o Key type/format: choose DSA or RSA

o Key length:

l If Key type/format = DSA: choose 1024

l If Key type/format = RSA: choose one of the following: 768, 1024, 1536, 2048, 4096,8192, 16384 or 32768

o Identity file: assign a name (the default name is identity)

o Password: for no password, do not enter anything

Caution: TheOpenSSH .pub format optionmust be selected.

3. Click Generate andmove your mouse to generate public/private keys.

4. Once the pair is generated, go toC:\Users\<username>\AppData\Roaming\MindTerm. Thisdirectory contains generated public/private keys pair. The public key has the .pub extension.

5. Copy the contents of .pub file to the remote Linux/Unix machine you want to connect to asfollows:

a. Connect to the Linux/Unix remotemachine and locate the ~/.ssh/authorized_keys file (if thefile does not exist, create it).

b. Open the file for editing as follows:

vi ~/.ssh/authorized_keys

c. Append the contents of the .pub file to the authorized_keys file.

d. Add <username>@<probe IP> to the end of the contents of the .pub file. For example, if thecontents of the .pub file are:

ssh-dss AAAAB3N.....<snippet>.....r2LnQrqhncpJyL1s0id76j6wA==

and the probe's IP is 16.59.56.255 and the username to connect with is root, you wouldappend the following to the contents of the ~/.ssh/authorized_keys file:

ssh-dss AAAAB3N.....<snippet>[email protected]

e. Save the ~/.ssh/authorized_keys file and close it.

6. Open the UCMDB and go toData Flow Management > Data Flow Probe Setup > Credentials

Discovery and Integrations Content Guide - General ReferenceChapter 8: Additional Protocol Information


> SSH Protocol.

7. Add a new SSH protocol with the following parameters:

o Authentication Method: publickey

o User Name: root

o Key File Path:C:\\Users\\<username>\\AppData\\Roaming\\MindTerm\\<identity file>,where <identity file> is the name you entered in step 2.

o Password: if you provided a password during creation of the public/private keys pair, youmustenter the same password here.

How to Enable Support for the AES256-CBC and AES256-CTR Encryption CiphersTo enable support for the AES256-CBC and AES256-CTR encryption ciphers, perform the followingsteps:

1. Stop the UCMDB server and Data Flow Probe service.

2. Download theUnlimitedJCEPolicyJDK7.zip file fromhttp://www.oracle.com/technetwork/java/embedded/embedded-se/downloads/jce-7-download-432124.html.

3. Extract the ZIP package.

4. Copy the local_policy.jar andUS_export_policy.jar files to the <DataFlowProbe installationfolder>\bin\jre\lib\security directory to replace the old ones.

5. Start the UCMDB server and Data Flow Probe service.

Discovery and Integrations Content Guide - General ReferenceChapter 8: Additional Protocol Information


http://www.oracle.com/technetwork/java/embedded/embedded-se/downloads/jce-7-download-432124.html

http://www.oracle.com/technetwork/java/embedded/embedded-se/downloads/jce-7-download-432124.html

Chapter 9: PrimaryDNSName LogicPreviously, theDNS Resolver job sets thePrimaryDNSName (primary_dns_name) of a Node to theresolved DNS name of the smallest IP address integer equivalent among all IP addresses contained bya given Node. If either the backup network or cluster virtual IP addresses have a numerically smalleraddress than the address of the Node, that address incorrectly updates thePrimaryDNSName of theNode.

In order to solve this issue, thePrimaryDNSName logic is changed as follows:

For a full DNS name (for example, host1.cms.chn.hpe.com),

l If the short name (that is, host1 in the example) of the full DNS name is NOT equal to the hostname, the full DNS namewill NOT be considered as thePrimaryDNSName.

l If the short name (that is, host1 in the example) of the full DNS name is equal to the host name, thefull DNS namewill be one candidate of thePrimaryDNSName.

For each candidate,

a. Covert its related IP address to the integer equivalent, and then retrieve the smallest one.

b. Take the DNS name of the smallest IP address integer equivalent as thePrimaryDNSName.

For example:

l Node 1 has three IP addresses: A, B, C; the host name is host1.

l IP address A is resolved as host1.cms.chn.hpe.com.

l IP address B is resolved as host2.cms.chn.hpe.com (That is possible, in the clusterenvironment, some cluster IP addresses can be resolved as cluster names).

l IP address C is resolved as host1.chn.hpe.com.

l IP address B is the smallest IP address integer equivalent.

Previously, theDNS Resolver job takes host2.cms.chn.hpe.com as thePrimaryDNSNameregardless of the fact that host2 !=host1, because IP address B is the smallest IP address integerequivalent.

Currently, host2.cms.chn.hpe.com is no longer considered as thePrimaryDNSName. Bothhost1.cms.chn.hpe.com and host1.chn.hpe.com are candidates of thePrimaryDNSName. Forthese candidates, covert their related IP addresses to the integer equivalents. If A > C,host1.cms.chn.hpe.com is thePrimaryDNSName.


Chapter 10: Supported UNIX ShellsUCMDB supports use of the following UNIX shells:

l bash

l csh

l ksh

l tcsh


Chapter 11: Troubleshooting and LimitationsThis section describes general troubleshooting and limitations related to performing discovery usingUniversal Discovery.

l Problem: Cannot Connect toWindows Vista/2008-R2Machines with UAC Enabled

Reason:Starting fromWindows Vista, Microsoft has changed the security mechanism byintroducing the UAC (User Account Control) technology. This change causes problems withHPCmd connecting to remoteWindows Vista/2008-R2machines when using the localadministrator account.

Solution: The following procedure enables HPCmd connection to remoteWindows Vista/2008-R2machines with UAC enabled.

a. Verify the HPCmd connection

i. Log on to the Probemachine.

ii. Locate theHPCmd.bat file in hp\UCMDB\DataFlowProbe\tools directory.

iii. Open cmd.com in the same directory.

iv. At the command prompt, invoke following command:

HPCmd.bat \\<problematic machine name or ip>/USER:<domain>\<username> /PWD:<password>

b. If the HPCmd connection is not successful, check accessibility to the shared folder, admin$.

Ensure that the Probemachine can access the shared folder, admin$, on the remotemachine.

i. Log on to the Probemachine.

ii. Select Start > Run, and enter \\<remote machine>\admin$ address.

iii. If there is no access to admin$:

l Log on to the remotemachine.

l Select Start > Run, and enter regedit.

l Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

l Click Parameters.


l If theAutoShareServer registry entry does not exist, in theEditmenu, select New> DWORD (32-bit) Value. EnterAutoShareServer, and click OK.

l Select AutoShareServer. In theEditmenu, selectModify, and in theValue box,type 1.

l Exit the Registry Editor, and restart the computer.

l Select Start > Run, and enter net start srvnet.

iv. When access to admin$ is successful, try to verify the HPCmd connection again asdescribed in "Verify the HPCmd connection" on the previous page.

c. If the verification still fails, connect toWindows Vista/2008-R2machines with UAC enabled.

i. OnWindows Vista/2008-R2machines, local administrators do not have full privilegeswhen connected remotely.

Use one of the following options to overcome this problem:

l Connect using domain administrator credentials.

l Enable local administrators to have full privileges by modifying the registry on remotemachine as follows:

Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system

Value LocalAccountTokenFilterPolicy should be set to 1.

If this value is not available, create a new DWORD value and set it to 1.

ii. Restart themachine.

l Problem: The file transfer does not work when communicating with the remote Linux/UNIX/MacOS X machines, as the result operations like Scanner-based Inventory Discovery or deployment ofUniversal Discovery agents fail.

Solution:

a. Make sure the SSH agent is configured to allow file transfer via the SCP/SFTP protocols.

b. Make sure that the logon process for the user that is used for the SSH protocol does not have abanner that requires manual user input during the logon process.

Discovery and Integrations Content Guide - General ReferenceChapter 11: Troubleshooting and Limitations


Send Documentation FeedbackIf you have comments about this document, you can contact the documentation team by email. If anemail client is configured on this system, click the link above and an email window opens with thefollowing information in the subject line:

Feedback on Discovery and Integrations Content Guide - General Reference (Universal CMDBContent Pack 20.00 (CP20))

Just add your feedback to the email and click send.

If no email client is available, copy the information above to a new message in a webmail client, andsend your feedback to [email protected].

We appreciate your feedback!

Discovery and Integrations Content Guide - General ReferenceSend Documentation Feedback


mailto:[email protected]?subject=Feedback on Discovery and Integrations Content Guide - General Reference (Universal CMDB Content Pack 20.00 (CP20))

Documents

Discovery and Integration Content Guide - General Reference · UniversalCMDB SoftwareVersion:ContentPack20.00(CP20) DiscoveryandIntegrationsContentGuide-General Reference DocumentReleaseDate:June2016